Endpoint directory
Find discovery, account, billing, and request-history endpoints.
Public discovery
All routes below also have an equivalent /api/v1 prefix.
| Method & path | Returns |
|---|---|
| GET /v1/models?view=catalog | All published models, independent of connected provider keys. |
| GET /v1/models | Available models; authentication scopes discovery to the account’s connections. |
| GET /v1/models/{author}/{slug}/endpoints | Endpoint capabilities, prices, and declared data handling. |
| GET /v1/providers | Provider directory; connection status is scoped to the authenticated account. |
| GET /v1/billing/plans | Published plans, billing intervals, and checkout availability. |
Private account reads
Use an authenticated browser session or a CyberRouter bearer key for these account-scoped reads.
| Method & path | Returns |
|---|---|
| GET /v1/key | The calling key’s label, limits, and usage; not its plaintext value. |
| GET /v1/keys/byok | Your connected provider keys, with masked credentials. |
| GET /v1/credits | Credit totals, available balance, and reservations. |
| GET /v1/billing | Wallet, effective fee, subscription, scheduled credits, and recent transactions. |
| GET /v1/usage | Model/date aggregates and paginated request history. |
| GET /v1/generation?id=… | A single request’s model, routing, token usage, and costs. |
Account changes
Manage application keys and provider connections from API Keys. The browser uses /v1/auth/keys/create and /v1/auth/keys/revoke for application keys. Provider connections use POST /v1/keys/byok and DELETE /v1/keys/byok/{credential_id}.
Creating a provider connection requires terms_accepted: true and terms_version matching the version on the service terms. Send these only after the account owner has reviewed and expressly accepted that version. Missing acceptance returns 400; a stale version returns 409. Revoking a connection does not require new acceptance.
Profile, password, privacy consent, checkout, and billing portal actions require an authenticated browser session with same-origin and CSRF protection. GET /v1/privacy and POST /v1/privacy are session-only.
Legacy engagement and workflow endpoints are disabled on the default public API. They are not part of the supported account API described here.